'Account activity notice' email threatens mailbox shutdown in 7 days, sends users to phishing site worksy.cc
MalwareTips reported on 1 November 2026 that an “account activity notice” email warns of mailbox shutdown in 7 days and sends users to a fake sign-in page at worksy.cc to steal passwords.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reported on 1 November 2026 on an “account activity notice” phishing email. The message claims that a request has been made about the recipient's mailbox and that its settings may become inactive within seven days unless the recipient clicks a “Keep Account Active” button. To look relevant, the email copies the recipient's own email domain into its footer. According to MalwareTips, the button leads to worksy.cc. MalwareTips describes the campaign as credential phishing. The claims here come from MalwareTips' report.
How the scam works
Once on worksy.cc, the visitor sees a page that imitates an email-provider sign-in. MalwareTips gives a Gmail-looking form as an example, asking for an email address and password, and says the form can change appearance according to the provider being targeted. The email does not show that a real request exists, or that the email provider has scheduled any change.
MalwareTips explains why the approach works. Your domain in the footer is not private knowledge: anyone who knows your email address already knows the part after the @ symbol. It can still be persuasive, as a message with your own organisation's domain feels more relevant than a generic notice. The deadline of seven days is short enough to feel like a task to clear but not dramatic enough to look like an obvious emergency. And “Keep Account Active” names a reassuring outcome instead of describing what the button does, which is to ask for the mailbox password. With that password an attacker can read mail, reset other accounts that use the address and send further phishing from it.
MalwareTips advises people not to click the button or sign in through the link, to check the account directly through the provider's official app or website, and to change the password if it was entered. For business mail, it suggests using the sign-in route supplied by your organisation or asking the person who manages mail. The wording about “inactive settings” is not a promise that messages will be deleted: check what the genuine account says.
Source
MalwareTips, “Account Activity Notice Email Scam: The Fake Seven-Day Mailbox Warning”, 1 November 2026.
Red flags
- An email saying a request about your mailbox is pending and settings will become inactive in seven days.
- A “Keep Account Active” button that leads to an unfamiliar site such as worksy.cc.
- Your own email domain copied into the footer, which makes the message look personalised.
- A sign-in page that imitates your email provider but is not on the provider's own domain.
- A request to enter your email password to prevent an action you did not start.
If you were targeted
- 1Do not click the button or sign in through the link to worksy.cc.
- 2Check your mailbox settings directly through the provider's official app or website.
- 3If you entered your password, change it now and sign out of other sessions, then turn on two-step verification.
- 4For work mail, tell your IT team or the person who manages mail.
- 5Report the email as phishing to your provider and delete it.